Domain Theft

[Commerce]

Hard to believe after nearly 25 years, but I got hit by criminals who have stolen a number of my domains. Any insights beyond working with the registrar of record to resolve this quickly?

-Commerce

 

[alcy]

Yes, thank you for that. Have been in touch with ICANN to establish the process needed, which will begin on Monday.

sorry if missed...how many names exactly?

 

[bulkdomainz]

Hope it gets resolved for you soon.

Actually several. But a little update. Having contacted the registrar support, I was advised to outline in detail the situation as an email to mail to their abuse, with an expectation of 24-48 hour response time. Ironically, their servers got back to me quite a bit faster... the message bounced. Hopefully, their legal team and my account manager will pick this up. Even so, I am going to reach out to their corporate group this morning. Based on the call, it was discovered that either forged or stolen physical credentials were used to convince them that the individual(s) were me. There is a little problem with their documentation I shall not share here. As you can imagine, I'm not pleased that along with some pretty strong names, they opted to go after my corporate identity.

The list of stolen domains discovered so far is as follows:

companies.net
experience.net
firstusa.net
ihba.com
ihba.net
ihba.org
isba.com
isba.net
pressclub.com
pressclub.net
schoolers.com
schoolers.net
clanmaitland.org
commercecompany.com
commercecompany.net
commercecompany.org
commerco.org
thecommercecompany.com
thecommercecompany.net
thecommercecompany.org

 

[Lil85]

I hope im not oot...but i was wondering, is it worth it to pay an advanced security for a domain (the one offered in the domain registry)? Will it prevent this incident?

 

[MapleDots]

I hope im not oot...but i was wondering, is it worth it to pay an advanced security for a domain (the one offered in the domain registry)? Will it prevent this incident?

Getting a good registrar and two factor security stops this.

When I phone godaddy they will not talk to me until I give them my generated code from my google authenticator.
It does not matter how much personal information I give them. It is because I asked for that service, even a simple support call needs that code so nobody can scam the support agent.

We are all human and with a lot of personal information it can look to the agent like he is talking to the domain owner.

The authenticator is your friend and even more secure than two factor with a text to your phone.

 

[Bob Hawkes]

Is there an update on the status of the recovery?
Really hope you got it back promptly.

 

[Commerce]

Is there an update on the status of the recovery?
Really hope you got it back promptly.

Bob, thanks for the question. At this point, every message I am sending to the registrar is being bounced through their normal and recommended contact method per their emails. I'm starting to get more than a bit frustrated by a phenomenal lack of communication. As a thank you, my registrar actually has now blocked my account with them. Kind of outrageous behavior for a customer who has been with them for longer than their current owners have held them. I'll keep you posted as I figure out how to navigate the system and get things back. Hopefully some of my discoveries may help others who may go through a similar experience.

Based on voice discussions, I understand the abuse team is on it, however I was also told I should have expected a phone call today that never happened. Will update tomorrow evening.

 

[CraigD]

Getting a good registrar and two factor security stops this.

When I phone godaddy they will not talk to me until I give them my generated code from my google authenticator.
It does not matter how much personal information I give them. It is because I asked for that service, even a simple support call needs that code so nobody can scam the support agent.

We are all human and with a lot of personal information it can look to the agent like he is talking to the domain owner.

The authenticator is your friend and even more secure than two factor with a text to your phone.

GD already have PIN numbers in place for security. My concern with 2FA is that it introduces another level of authentication that can be hacked. eg. Your phone number could be ported or your phone could be stolen, or you could cancel your phone number for whatever reason.

Increasingly, the onus of security is being placed on the end-user or other 3rd party services.

 

[CraigD]

I hope im not oot...but i was wondering, is it worth it to pay an advanced security for a domain (the one offered in the domain registry)? Will it prevent this incident?

I don't think you should have to pay extra for security in principle. It should be assumed that security is tight under the current systems.

 

[Bertrell]

My concern with 2FA is that it introduces another level of authentication that can be hacked

That is the primary issue with a certain type of 2FA--SMS--which is better than none at all, but still vulnerable via the example you gave. It is much more difficult to hack when an authenticator app/program (TOTP) or a hardware device/key (U2F) is used.

Making sure your phone stays locked when not in use helps, as does enabling password/biometric-protected access within the authenticator app itself. A number of registrars offer 2FA (some include a support PIN, like you mentioned--Epik also comes to mind). I have domains with several of them and 2FA is enabled at the account access level. Many also offer the additional option to enable 2FA for most domain configuration changes.

 

[MapleDots]

That is the primary issue with a certain type of 2FA--SMS--which is better than none at all, but still vulnerable via the example you gave. It is much more difficult to hack when an authenticator app/program (TOTP) or a hardware device/key (U2F) is used.

Making sure your phone stays locked when not in use helps, as does enabling password/biometric-protected access within the authenticator app itself. A number of registrars offer 2FA (some include a support PIN, like you mentioned--Epik also comes to mind). I have domains with several of them and 2FA is enabled at the account access level. Many also offer the additional option to enable 2FA for most domain configuration changes.

I hear the what if you lose your phone argument all the time, so I agree with you, keep it locked simple.

Now the real issue... how the hell does a domain thief get your phone?
I mean really, I keep hearing the argument against authenticator with people saying... if you lose your phone.

Give me a break please, domain thief's are usually from a distance away (like china) and they cannot get your phone so authenticator is virtually hack proof.

 

[JanO]

If the same registrar is this often involved in domain theft I would start to think someone within that registrar is actively involved in the theft. But maybe I'm dead wrong.

 

[bulkdomainz]

This scenario makes me wanna put all my names with a local registrar. If anyone tries this sh** with me, I'll be in court in a flash for an order that will have them releasing every single bit of info on what went down and making them liable for the safe return or my estimated value of my domain. Add a Police report of theft to that. They'll move fast to work something with the receiving registrar.

So sad to see this happening in our industry but the good news is no one can use those domains. Whoever buys them and puts a site or forwards them to a working site is in trouble.

Good luck, @Commerce

Bob, thanks for the question. At this point, every message I am sending to the registrar is being bounced through their normal and recommended contact method per their emails. I'm starting to get more than a bit frustrated by a phenomenal lack of communication. As a thank you, my registrar actually has now blocked my account with them. Kind of outrageous behavior for a customer who has been with them for longer than their current owners have held them. I'll keep you posted as I figure out how to navigate the system and get things back. Hopefully some of my discoveries may help others who may go through a similar experience.

Based on voice discussions, I understand the abuse team is on it, however I was also told I should have expected a phone call today that never happened. Will update tomorrow evening.

 

[MadAboutDomains]

I remember when web.com/netsol gave away France.com to another owner and didn't even have the courtesy to tell the owner who was running a business on there.

I wouldn't touch them with a barge pole.

That is by the by however, I hope that you are able to recover your names.

 

[Commerce]

Another day, another check in to implore the team at my registrar exploring the matter via their support folks to speak with me. So far, no joy. Very close to escalating the matter externally. At this point, I no longer have access to be able to login to my control panel to see what if any progress has been made.

I believe that this should not be rocket science. The kind of crime that has occurred here is not only foreseeable, it has already happened. Perhaps there is a backlog, but if I wanted to do something with the remaining domains, that is an option I no longer have. Thank heavens I was not in the middle of a sale, how remarkably unprofessional it would have made me look with a buyer.

 

[Commerce]

Well, figured an update was about due. Just before the end of February, connected with the security team and learned that the domains were immediately security locked on report. They have now been transferred back into my account, which also has additional security in place that should generally discourage any future attempts to steal domains from this registrar.

Thank you to all those who offered encouragement, advice and support. The biggest takeaways from all this are that you need to document everything, remain engaged in the process, keep asking about updates on the ticket(s) and don't lose hope. If you are new to domaining and do not have a history with a registrar you may well need to seek assistance from attorneys and resources who have expertise in recovery. Never be ashamed to share as a victim of online domain theft, as the community benefits from the experience.